.Dd Jul 10, 2025
.Dt RASIGN2 1
.Sh NAME
.Nm rasign2
.Nd radare2 signature management tool
.Sh SYNOPSIS
.Nm rasign2
.Op Fl afjhqrvSm
.Op Fl A Op AAA
.Op Fl i Ar script.r2
.Op Fl o Ar sigs.sdb
.Op Fl s Ar signspace
.Op Fl c
.Op Ar file
.Sh DESCRIPTION
Generates, dumps, and manages zignature scripts for function identification and cataloging. Zignatures are Radare2 scripts that capture metadata associated with function signatures.
.Pp
Supports interpretation of FLIRT '.sig' files, execution of zignature scripts, and exporting signatures in various formats.
.Sh OPTIONS
.Bl -tag -width Fl
.It Fl a
Make signatures from all .o files in the provided .a file
.It Fl A Op AAA
Same as r2 -A, the more 'A's the more analysis is performed
.It Fl f
Interpret the file as a FLIRT .sig file and dump signatures
.It Fl h
Show help menu
.It Fl j
Show signatures in json
.It Fl i Ar script.r2
Execute this script in the r2 instance
.It Fl o Ar sigs.sdb
Add signatures to file, create if it does not exist
.It Fl q
Quiet mode
.It Fl r
Show output in radare commands
.It Fl S
Perform operation on sdb signature file ('-o -' to save to same file)
.It Fl s Ar signspace
Save all signatures under this signspace
.It Fl c
Add collision signatures before writing file
.It Fl v
Show version information
.It Fl m
Merge/overwrite signatures with same name
.El
.Sh ENVIRONMENT
.Pp
rasign2 does not use any environment variables.
.Sh EXAMPLES
.Pp
Generate signatures from a library file:
.Pp
  $ rasign2 -o libc.sdb libc.so.6
.Pp
Perform deep analysis before generating signatures:
.Pp
  $ rasign2 -AA -o enhanced_libc.sdb libc.so.6
.Pp
Output signatures in JSON format:
.Pp
  $ rasign2 -j input_file
.Pp
Show signatures as radare2 commands:
.Pp
  $ rasign2 -r input_file
.Pp
Merge new signatures into an existing file:
.Pp
  $ rasign2 -m -o existing.sdb new_binary
.Pp
Extract signatures from a FLIRT .sig file:
.Pp
  $ rasign2 -f flirt_signatures.sig
.Sh THE Z COMMAND IN RADARE2
.Pp
The 'z' command in radare2 is dedicated to the management of binary signatures, known as zignatures. Here are the key subcommands:
.Bl -tag -width Fl
.It Cm z
Show zignatures
.It Cm z.
Find matching zignatures in current offset
.It Cm zb
Search for best match
.It Cm zd
Diff current function and signature
.It Cm z*
Show zignatures in radare format
.It Cm zo
Manage zignature files
.It Cm zf
Manage FLIRT signatures
.It Cm z/
Search zignatures
.It Cm zc
Compare current zignspace zignatures
.It Cm zs
Manage zignspaces
.It Cm zi
Show zignatures matching information
.El
.Pp
These commands facilitate a robust workflow for binary analysis, enabling the identification of known functions and comparing binary similarities.
.Sh SUPPORTED ZIGNATURE METRICS
.Pp
Zignatures in radare2 can be created with various metrics:
.Bl -tag -width Fl
.It Cm a
Bytes pattern (masked)
.It Cm b
Raw bytes pattern
.It Cm c
Base64 comment
.It Cm n
Real function name
.It Cm g
Graph metrics (complexity, edges, basic blocks)
.It Cm o
Original offset
.It Cm r
References
.It Cm x
Cross references
.It Cm h
Basic block hashes
.It Cm v
Variables and arguments
.El
.Sh SEE ALSO
.Pp
.Xr radare2(1)
.Sh AUTHORS
.Pp
pancake <pancake@nopcode.org>